I just got an email about this settlement telling me that I've been awarded a 10% off coupon for Zappos due to this ruling. So I actually have to give them more business to recoup anything... it's almost as if this settlement is going to be good for business.
Thanks for reminding me about that. Credit cards I get cancel and get new ones, but my passport data which Cathay Pacific failed to protect, this unfortunately cannot be changed and the data is floating around somewhere.
Who cares if their card gets stolen these days? Last time it happened to me I just spent 3 minutes on live chat to dispute the charges, new card arrived after 48 hours and applepay worked immediately.
I opted out of a class action settlement once (the Google/Apple/etc wage fixing lawsuit). The opt-out did absolutely nothing except that I didn't get a check but I did retain my right to sue. The tart letter I wrote to the judge about the quality of "my" attorney, though, that got a reaction. Not from the judge, but from those attorneys. They went from "won't return your email" to "very concerned to make sure I was satisfied". Only time I've ever had a lawyer dance for me.
The opt-out isn't really supposed to "do anything," because it doesn't necessarily mean you disagree with the settlement, just that you would rather litigate on your own in your specific case.
I opt out of them all. Partly I object to being tallied up as a profit source for lawyers I've never met and who certainly are not working for me. But mostly, it entertains me to write them letters with, perhaps, less sincerity than they're used to receiving.
If I'm supposed to waste my time over their collusion with the supposed offender in order to legitimize their payday, they can waste theirs entertaining me so I actually get something out of it.
Right, but I'm interested in what happens if you _object_ rather than _opt out_. I wonder what the court's process for considering those objections is.
“Both sides agreed to a settlement to avoid the uncertainty and cost of litigation, and to provide benefits to Class Members more promptly. The Court did not decide in favor of the Class Representatives or Zappos. Zappos denies any liability or wrongdoing of any kind associated with the claims in this class action.”
It was a mutually agreed upon arbitration, no judges were involved in the decision.
So the lawyers, who got a million and a half bucks, agreed to settle on behalf of the 145 million victims for $22,500 - or a value of ~$0.000015 per victim.
"The first thing we do, let's kill all the lawyers" -- Shakespeare, 1591
There's no "decision," just an agreement. However, judges often must approve settlement agreements to ensure that it doesn't benefit only the attorneys. (Yes, this one looks bad, but looking at the numbers involved here, the attorney's fees look pretty reasonable in terms of the amount of time spent on the case.)
The same could be said for any profession, yet, as we all know, plenty of effort has been "wasted" writing software or services that ultimately were a flop.
They are not reasonable if they bring 0 value anyone but themselves and zero punishment. It's net negative since they spent everyone's times and hence also public money.
I think it comes down to lawyers * time spent * rate + paralegals * time spent * rate, and knowing that a class action probably requires a lot of work.
Given that, I think GP is probably right in that the fees look reasonable, it's just that maybe it's a case that shouldn't have been litigated if the payout was going to be that small.
Think of it this way, if you want to sue your neighbor for causing some damage to your car, and you expect the money you can recoup is probably capped at around $5k (maybe the amount it cost you to fix), do you hire a lawyer to litigate it for you? If you do, and the lawyer gets you that $5k, but presents you a bill for $4,800 for time spent, do you blame the lawyer, or perhaps was it not worth using that exact strategy to recoup your money, and you would have been better served by small claims court.
So, the question here is, was the payout ever expected to by significantly higher? If not, then there's probably no reason for it to have been a class-action. If so, it probably just depends on even more variables. In the end, people got something out of it, which is probably more than they would have gotten otherwise. Also, there's the benefit of companies knowing they can be sued for these data breaches, which allows them to put a real cost to it, so they put more towards making sure it's secure, even if it didn't help the individuals much in this instance.
I just got the same email. I don't want a discount coupon. I want the fuckers who wouldn't properly secure information to be in gaol, and if the court can't or won't do that I want them to be bankrupted and made destitute to be a lesson to others who capture my information.
I can't even figure out from the email how to object to this settlement. It is absolutely insane that the settlement is in a discount code. How any court could find that satisfactory is absolutely obnoxious and demonstrates that the rule of law has been perverted by large corporations.
I would appreciate it if anyone could let me know how to formalise my objection to the judge presiding this case as their website is as clear as mud.
This is what I sent to the email address on the court's webpage. I ope that is the correct place to send my objection.
To whom it may concern,
I received an email about this "settlement". The email was unclear on how to object to this "settlement". I wish to formally state my objection to this settlement. I fail to see how a discount for future purchases will dissuade organisations from not implementing appropriate security measures. If anything this is a boon to Zappos as to receive the benefit you must spend money with them.
This settlement is incongruous with the purpose of equity courts which is to right a wrong. A discount for a future purchase does not right a wrong and makes a mockery of the court. Further, this settlement does not accord with the consequences of e: Equifax Inc. Customer Data Security Breach Litigation, Case No. 1:17-md-2800-TWT.
I hope the court rejects this agreement and seeks proper remedies for those impacted and appropriate consequences on those who failed in their duties that caused this lawsuit.
Every class action settlement I've been a part of in here in the USA has ended up with a similar outcome. As far back as when my parents bought Kodak's instant film camera that got sued out of existence by Polaroid, my parents got a coupon for a discount on a specific model of camera they could never find at a store (this was way before the internet) and coupons for Kodak brand batteries.
Hm, if the lawsuit is going to drive more customers to them, wouldn't it make more sense to also include an injunction requiring them to comply with GDPR-like laws? That would seem to head of the potential of further data loss.
This is an absurd sum, both in the fees:rewards ratio, and in the total amount ($22,500 might as well be nothing for all of the people involved).
That said, I'm a bit surprised to see a "Rake them over the coals" attitude on HN. They leaked a DB with hashed passwords, user data, and last 4 digits of credit cards. That happens to even the most responsible websites all the time, even with seven years of best practices to build upon. I know it would have absolutely happened to the awful, framework-less PHP I was writing back in 2012.
Without letting Zappos off the hook for not taking security more seriously, it seems to me that substantial, non-ridiculous monetary punishments should be reserved for instances of deliberate recklessness, or at least clear, preventable negligence.
Their settlement ended up costing as much as a few good engineers for a year. Consequences like that will mean it makes financial sense to ignore security and just pay the settlements as they come.
Consequences should motivate companies to be secure. i.e. it should be much cheaper to hire a large competent security team who has a chunk of engineer time than it is to pay tiny settlements to teams of lawyers.
Data breaches aren't just necessary evils, they can be prevented, but not without a lot of extra work. Companies should consider a data breach to be an existential threat, not a cost of business.
> Consequences like that will mean it makes financial sense to ignore security and just pay the settlements as they come.
If judgments like this were the only reason to prioritize security, then sure. But hopefully there are at least some market/reputational forces at work too.
The Ashley Madison Breach comes to mind. If the core demographic cares about not wanting their data on the platform to get out, they will vote with their feet. That said, I think this example is not the norm, and most people probably won't care for most applications.
https://en.wikipedia.org/wiki/Ashley_Madison_data_breach
I mean wasn't it also revealed that an overwhelming amount of people on the site were male in the same breach? Id guess that would be a motivating factor more than the privacy
I worked for a much smaller place with far less resources than Amazon (which is what Zappos is) and our PCI compliance as a payments processor was rock solid. Our systems were under attack all the time from all corners of the globe and we never suffered a breach.
If you can't manage PCI compliance then you shouldn't be involved with credit cards.
> I know it would have absolutely happened to the awful, framework-less PHP I was writing back in 2012.
If you were writing framework-less PHP in 2012, you were doing it wrong. There were major frameworks well before that point: CakePHP (Apr 2005), Symfony (Oct 2005), CodeIgniter (2006) and even Laravel (2011).
The argument is that the total amount of the settlement is important as a disincentive to corporations to engage in negligent behavior, and that the disproportionate amount of money that goes towards the attorneys is necessary to convince said attorneys to take up such cases.
Of course, one could also argue that this has just created a new form of venture lawyering, with attorneys who give zero shits about their clients chasing compliance violations rather than ambulances, and businesses baking these lawsuits into their profitability calculations.
Due to health care inequalities people are talking about single payer where the government is the only payer.
However, an even bigger problem is legal inequalities. Rich people can afford top legal representation and poor people cannot. We should instead have single payer legal representation. Lawyers are required to charge a standard fee and are paid by the government for their work. They are not allowed to accept payments in addition to the standard government payment or to take contingency fees.
Doing this would ensure that the poor in America are not disadvantaged due to the rich having better lawyers.
Standard fee is a good idea. It works in Germany. Another idea is to have a portion of legal fees go to offering counsel. If you spend five million on lawyers, I get two and a half million for my lawyers.
Really reduces the incentive for overspending the opposing party and encourages cheap quick settlements.
Two problems, first is this would either end all class-action lawsuits, or spawn way too many of them. If a lawyer is guaranteed an hourly rate to work any case, then why wouldn't they? Currently, there's a natural limit on class-actions based on the validity (chance of winning) of the case. Since most people can't pay for the hundreds (or thousands) of hours of work necessary, they're all on contingency. If contingency is no longer possible, then how would class-actions be regulated?
Second issue is that there is a huge variance in the skill of lawyers and that skill has huge impacts on the outcome of cases. It'd be just like fixing the pay of software engineers in terms of results.
I don't know why more people don't say this. I agree 1000%. This should absolutely be the case. Why should anyone have a lower probability of winning a lawsuit just because they're poor?
Because no one has yet come up with a better system that works.
If there exists differences in skill, then there exists arbitrage opportunity. How one can prevent that arbitrage opportunity from being used in order to keep things “fair”, I do not know and have not heard of any compelling ideas.
One of the ideas I heard about recently that I think could do well in helping address the issue is "Investable Lawsuits". This would allow potential lawsuits to crowdsource lawyer fees and get returns on this investment out of the winnings. While this might not help address the cost of representation (although it might as lawyers would work for a smaller upfront fee then a larger take of the winning if it was done pro bono), but it would help the lower and middle class individuals take on corporations and the rich.
There's quite a lot about this that I like, but I think we need a way to handle investigations. Let's say I think I'm innocent and that a blood test might prove it. Who decides whether I can order one done? What if the government decides that it's not a valid expense?
Similarly, can I have expert testimony at my trial? Can everybody?
Isn't there already quite a few lawyers that will take a case on contingency? Usually this is based on whether the client has a legitimate/strong case, and in that way is self regulating. With healthcare there's no incentive to take on a case for free because there's no payout for a positive outcome.
Lawyers are required to charge a standard fee and
are paid by the government for their work.
Your goal is noble and I agree with it, but surely we need to recognize that some legal cases require orders of magnitude more effort and resources than others. I don't know how a standard fee could possibly cover this, even if we had different standard fees for different classes of crime.
Just like we do with doctors and Medicare. Treating someone for a cold requires much less resources than doing a liver transplant. They submit a detailed invoice stating all the work they did and the justification for it. Each item of work has a standard reimbursement rate.
That'd be the end of any chance of suing the government. A large number of Trump's proposed policies (eg. the Muslim ban) would've passed through without resistance because no lawyer is going to sue the organization that signs their paychecks.
We already have the concept of separation of powers. Judges are paid by the government, but issue injunctions agains and rule against the government all the time. We make sure that this is under the purview of the judiciary.
> However, an even bigger problem is Smart Phone inequalities. Rich people can afford top iPhones and poor people cannot. We should instead have single payer phone system. OEMs are required to charge a standard fee and are paid by the government for their work. They are not allowed to accept payments in addition to the standard government payment or to take contingency fees.
/s
But there is so many issues with the government taking on _more_ responsibility in our lives (like they usually do things worse). Not to mention in US, we are guaranteed right to lawyer in defense, for equality, and those lawyers make way less than private lawyers, so presumable there is a difference in quality (or something else?). Additionally, its common to see legal fees part of law suits like this zappos suit), so lawyers can work for poor people because they get paid when they win a suit, which is their job anyways.
It seems like this creates a large incentive to push externalities onto millions of voiceless users and then pay off a handful of lawyers to avoid the actual court case.
If you cost 300M people each $20 worth of time and aggravation so that you can make $5B, your net effect on the economy is a cool negative $1B. However, no individual person would ever find it worthwhile to file a lawsuit for $20. That's why we invented class action lawsuits, but if the company settles for say $300M (that's 5 cents on the dollar), 1/3 of that goes to the legal team and 2/3 goes to the class members (in the form of free credit monitoring or a 10%-off coupon or something), and a legal team of 10 splits the legal fees, that's F-U money for every lawyer involved, under a dollar for each class members, and a profit of $4.7B for the company. The transaction is value-destroying for the economy as a whole, but happens regardless because it fits each individual participants' incentives. All because the legal system cannot scale to the harms that may be inflicted upon members of the public.
Suits do not always make the suing party whole, for a number of reasons, yet still have value in enforcing law.
Additionally, many arrangements (particularly class action) have attorneys assuming the entire financial risk of the a loss, and it's reasonable for them to be paid for this service.
---
That said...we're not taking about 30% to the plaintiff, or even 5%. It's 1.4%!!!
It's like saying Facebook founders get a combined 1.4% of the company.
Although, to be fair, no harm or negligence has actually been demonstrated in the case of this suit. Which is probably why the settlement amount is so low. I can hardly imagine these lawyers actually made their typical rates getting paid only $1.5M for a matter that took seven years to resolve. From the outside this looks more like a situation where Zappos said, "fine, we'll give you a token amount to go away."
I've never heard the term "venture lawyering" before but it seems apt.
It reminds me of somebody who lawyered up after being denied disability benefits. The lawyer took the case if the client signed over 25% of the payment in perpetuity.
On one hand, yes, they're helping someone resolve the issue without funds to pay for it. But I'm still bothered by the fact the lawyer is either a) cutting deeply into the funds of somebody who needs it because of a true disability or b) is helping someone game the system if they don't need it.
The attorneys have also been working on this case since 2012. Paying the salaries of a law firm (including paralegals, and through any number of appeals up to the Supreme Court) over the course of 7 years is going to be really, really, expensive.
In light of that, $1.5m is probably an overall loss for the law firm.
It's really expensive if you have to pay the lawyers their regular rates. But their costs are a small fraction of that. You should not compare 'retail' with 'house'.
It's similar to a car dealership trading in a car that is 'uneconomical to repair' on a new vehicle. Then they repair it anyway and sell it. Because shop costs and parts costs for them are not the same as shop costs and parts costs for you.
How about we compare it with software development (knowledge work) instead of retail or car mechanics?
One good software dev will cost a company almost a quarter of a million dollars every year. More if in NY or SF. 6 years of one knowledge worker’s salary would run the bill over the $1.5m. 7 years, with paralegals, expenses (for physically attending the various appeals), and a dozen other small expenses I’d be shocked if their actual costs were under $1.5m.
The cost of programmers in a very limited area of the United States is not sufficient to define the cost of software development in general.
Paralegals are essentially slave laborers who get billed out at huge rates but who take home a pittance in the hope of making partner one day. The legal profession is not what it's cracked up to be unless you make partner or go into business for yourself.
My cost of a knowledge worker is based out of Ames, IA. Not precisely a hotbed of 200,000 salaries. But it is indicative of a professional and the indirect costs associated with employing them (payroll taxes, health benefits, bonuses, etc).
It's 7 years, and a minimum of 3 in-person court visits, plus any number of briefs, letters, preparation, and communicating with the plaintiffs (only some of this work is done by the paralegals; all the paralegal's work still goes through a lawyer). Perhaps you can be a bit more explicit in how you think all that effort wouldn't cost the firm millions of dollars?
>...Paying the salaries of a law firm (including paralegals, and through any number of appeals up to the Supreme Court) over the course of 7 years is going to be really, really, expensive.
According to the document:
"...Both sides agreed to a settlement to avoid the uncertainty and cost of litigation, ..."
>...In light of that, $1.5m is probably an overall loss for the law firm.
I don't think there is any evidence that this is an overall loss for the firm.
Are our nation's courts + lawyers the best risk management managers out there? There are other people in government that could be doing this work (the people at the FAA or FDA spring to mind).
We ran into this at a previous job. The firm got sued by a group of attorneys, who between them didn't have a single plaintiff. We settled out of court, which means that while they didn't get the windfall they wanted, they still got a decent payday that more than paid their filing costs.
An even more convincing case would be if companies screwing with their customers would have to pay MUCH more, and as a consequence plaintiffs would get a bit more $$ each.
I think a better solution is for consumers to simply stop giving so much information to companies. If you are selling apparel/shoes etc then the only information you need from me is my shipping information. This is why I like cryptocurrencies. When you pay, all of your personal information is concealed.
There’s so much wrong with settlement payouts, but one of the less talked about problems is how all of them get .com domains that look straight out of “How to Spot Phishing 101”. Can someone please tell lawyers to figure out how to make these not look super sketchy?
It almost seems like it'd be in their best interest for them to be sketchy. It'd keep people from trying to get their settlement so that the time eventually runs out.
1) punishing the bad actor is more important than restitution. it's more important that Zappos is punished to discourage bad behavior from Zappos or anyone else, less important how exactly the punishment money is split up
2) since lawyers can get paid out of the settlement, it incentivizes independent lawyers to go after bad companies wherever they may be rather than needing regulators. so you don't need to maintain and hire a bunch of regulators and their legal teams, which will often be too many or too few.
other countries may prefer things the other way around and often do. it's easy to think of pros and cons either way.
In countries like that I would expect the result to:
1) not involve a civil suit whatsoever - instead of filing a class action claim resulting in a settlement or penalty assigned by a court, the people would complain to the relevant regulator, who'd investigate, impose fines and mandate changes in company processes.
2) in a scenario like this - where none of the complaintants assert any specific direct loss but simply generic increased future risk - there would be no payments to the affected individuals at all, any fines would go to the government; the main goal will be to enforce future compliance with the rules, and punish past incompliance with fines to deter other violators. Individuals can demand and get compensation that will cover specific actual damages that can be demonstrated, but no more, and nothing unless/until any consequences materialize. The "You wronged me, I'll sue you for $$$$ despite not being actually $$$$ out of pocket right now" style of civil claims (that seems to be common in USA, at least in mass media) is rare, and when it happens, it's usually unsuccessful.
In a different country it probably wouldn’t have taken years for a violation to be found and a penalty imposed. And therefore any lawyers would be paid much less.
This must not be a good one, then, because $1.5M is barely enough to set one attorney up for life, let alone however many folks were presumably involved in this case.
Just like startups, class actions are a lot of risk and sometimes the rewards don't make up for it. This is basically a middling exit in the startup world.
I agree, but I think most people wouldn't agree with the conclusions.
For example - if someone is criminally wronged in a property crime, wouldn't it make more sense to leave them free but garnish their wages to make the wronged individual whole instead of putting them in prison for decades? Yet if you bring up the idea of compensating the victim instead of punitive justice, a majority of people are extremely offended by the idea.
From that point of view, it isn't surprising at all that class action lawsuits are much more about retribution than restoration in the adversarial system.
Which may not be awful depending upon how much time they spent on it--though I'm guessing it isn't great on a per-hour basis. The bigger point is that everyone else other than the plaintiffs got a coupon that's probably a lower discount than Zappos routinely emails out for Arbor Day.
get a little price discovery on how much data is worth while re-targeting a bunch of customers that stopped using your service sometime over the last decade
Can anyone put this in perspective for penalties for other data breaches? Honestly I'm used to data breaches having no penalties other than maybe "we'll sign you up for credit monitoring" (that I don't want or need).
The problem I see is that lawyers then only care to recoup enough to make their ledger work out.
If you said my settlenent is $80 I'd say go for broke. Take it all the way or go home. No but the lawyer sees a perfectly cromulent payday for themselves so they'll encourage the class to accept the deal.
I wasn't aware that there were any laws about data breach settlements from 2012. I detected a breach at Macmillan Publishers around that time[1] and have been wondering if they were still liable.
Don’t lawyers have a fiduciary duty to their clients to act in their best interests? This is definitely not in their clients best interests.
I wonder if people in the class action can bring a bar complaint against the lawyers in the case and have them disbarred?
